https://vulnogram.org/ Most recent CVEs assigned by Black Duck Software, Inc. (blackduck). https://vulnogram.org/seaview/icons/blackduck.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-76055 https://vulnogram.org/CVE-2026-76055 Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system command… High Mon, 24 Aug 2026 14:17:23 GMT https://vulnogram.org/CVE-2026-76054 https://vulnogram.org/CVE-2026-76054 Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environmen… High Mon, 24 Aug 2026 14:16:36 GMT https://vulnogram.org/CVE-2026-8338 https://vulnogram.org/CVE-2026-8338 A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and… Critical Network Exploitable Wed, 29 Jul 2026 16:38:40 GMT https://vulnogram.org/CVE-2026-8339 https://vulnogram.org/CVE-2026-8339 A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database conte… High Wed, 29 Jul 2026 16:31:23 GMT https://vulnogram.org/CVE-2026-1496 https://vulnogram.org/CVE-2026-1496 Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or gue… Critical Network Exploitable Fri, 27 Mar 2026 14:14:01 GMT https://vulnogram.org/CVE-2025-0504 https://vulnogram.org/CVE-2025-0504 Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator fun… Medium Fri, 21 Nov 2025 21:30:53 GMT https://vulnogram.org/CVE-2024-12021 https://vulnogram.org/CVE-2024-12021 Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may result in the compromise of local accounts managed by the Coverity platform as well as other… High Mon, 31 Mar 2025 14:00:20 GMT https://vulnogram.org/CVE-2024-12245 https://vulnogram.org/CVE-2024-12245 Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the… High Network Exploitable Fri, 14 Mar 2025 18:11:14 GMT https://vulnogram.org/CVE-2024-12020 https://vulnogram.org/CVE-2024-12020 There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into clicking a crafted link to trigger the vulnerability. Stealing the session cookie is not po… Medium Network Exploitable Fri, 14 Mar 2025 18:09:24 GMT https://vulnogram.org/CVE-2024-12019 https://vulnogram.org/CVE-2024-12019 The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existi… High Fri, 14 Mar 2025 18:07:01 GMT https://vulnogram.org/CVE-2024-54449 https://vulnogram.org/CVE-2024-54449 The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to f… High Fri, 14 Mar 2025 18:04:20 GMT https://vulnogram.org/CVE-2024-54448 https://vulnogram.org/CVE-2024-54448 The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting… High Fri, 14 Mar 2025 18:01:25 GMT https://vulnogram.org/CVE-2024-54447 https://vulnogram.org/CVE-2024-54447 Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on… High Fri, 14 Mar 2025 17:57:26 GMT https://vulnogram.org/CVE-2024-54446 https://vulnogram.org/CVE-2024-54446 Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending… High Fri, 14 Mar 2025 17:53:01 GMT https://vulnogram.org/CVE-2024-54445 https://vulnogram.org/CVE-2024-54445 Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the p… High Network Exploitable Fri, 14 Mar 2025 17:49:44 GMT https://vulnogram.org/CVE-2024-11144 https://vulnogram.org/CVE-2024-11144 The server lacks thread safety and can be crashed by anomalous data sent by an anonymous user from a remote network. The crash causes the FTP service to become unavailable, affecting all users and processes that rely on it for file transfers. If the… Critical Network Exploitable Mon, 16 Dec 2024 17:00:52 GMT